unlabeled network data

Unlabeled network data holds the key to app detection at scale

Unlabeled traffic is the only realistic path when you need to identify 3,000 to 5,000 apps without a labeled dataset to train on. Your instinct to treat 15-second windows as bags and use self-supervised pretraining is the right foundation, especially masked modeling on flow features. The real risk is the encoder learning device identity instead of app behavior, so contrastive pairs must come from varied sessions. Fine-tune with your 100 labeled apps and validate that embeddings cluster by app, not by device.